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1. The essential difference between monoalphabeitic and polyalpha- 
betic substitution. - a. In the substitution methods thus far discussed 
it has been pointed out that thi-er basic feature is that of monoalpha- 
beticity. From the cryptanalytic standpoint! neither the nature of the 
cipher symbols , nor their method of production is an essential feature, 
although these may be differentiating characteristics from the crypto- 
graphic standpoint. It is true that in those caseB designated asi mono- 
alphabetic substitution with variants or multiple equivalents! there is 
a departure } more or less considerable! from strict .monoalphabeticity. 

In some of those cases i indeed , there may be available two or more wholly 
independent sets of equivalents! which f moreover! may even be arrangod 
in the form of completoly soparato alphabets. Thus! whilo a loose tor- 
minology might permit one to designate such systomB as polyalphabotic! 
it is bettor to roserva this nomenclature for thoso cases whorein poly- 
alphabeticity is tho essonco of the mothod f spocifically introduced with 
tho purpose of imparting a positional variation in tho substitutivo 
oquivalonts for plain-text lottors } in accordance with some rulo diroctly 
or indiroctly connoctod with the absoluto positions tho plain-text lottors 
occupy in tho mossago. This point calls for amplification. 

b. In monoalphabotic substitution with variants tho objoct of having 
difforont or multiplo oquivalonts is to suppress, so far as possible by 
simplo mothods, tho charactoristic froquoncios of tho lottors occurring 
in plain toxb. As has boon notod, it is by moans of thoso characteristic 
froquoncios that tho cipher oquivalonts can usually bo idontifiod. In 
thoso systems tho varying equivalents for plain-toxt lottors aro subjoct 
to tho froo choice and caprico of tho onciphoring clork; if ho is caroful 
and consciontious in the work, ho will roally mako uso of all tho diffor- 
ont equivalents afforded by tho systom; but if ho is slip-shod and hurriod 
in his work, ho will uso tho somo oquivalonts ropoatodly rather than tako 
pains and time to rofor to tho charts, tablos, or diagrams to find tho 
variants. Uoroovor, and this is a crucial point, ovon if tho individual 
onciphoring clorks aro oxtromoly caroful, whon many of thorn omploy tho 
8o.mo system it is ontiroly impossible to insuro a comploto divorsity in 
tho onciphormonts produced by two or moro clorks working r.t difforont 
mossago contors. Tho result is inovitably to produce plonty of ropoti- 
tions in tho toxts emanating from sovoral stations, and whon toxts such 
as thoso aro all availablo for study thoy aro opon to solution, by a com- 
parison of thoir similarities and difforoncos. 
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£. In true polyalphabetic systems, on the other hand, there is 
established a rather definite prodedure 'which automatically deter- 
mihSb the shifts or changes in equivalents or in the manner in which 
they are introduced, so that these changes are beyond the momentary 
whim or choice of the enciphering clerk, whorl the method of shift- 
ing or changing the equivalents is scientifically aound and suffi- 
ciently complex the research necessary to establish the values of 
the cipher characters is much more prolonged hnd difficult than is 
the case even in complicated mo noalphabet ic substitution with variants, 
as will later be seen. These are the objects of true polyalphabetic 
substitution systeus. The number of such systems is quite large, and 
it will be possible to describe in detail the cryptanalysis of only 
a few of the more common or typical examples o'f methods encountered 
in practical military cryptanalysis. 

The three methods, (l) mono- equivalent monoalphabetic substi- 
tution, (2) monoalphabetic substitution with Variants, and (3) true 
polyalphabetic substitution show the following relationships as regards 
the equivalency between plain-text and cipher-text units 1 

A. In method (l), there is a set of 26 symbols; a plain- 
text letter is always represented by one and only one of these 
symbols; conversely, a symbol always represents the Bame plain- 
text letter. The equivalence between the plain-text and the 
, cipher letters is constant in both encipherment and decipherment. 

*■ - B. In method (2), there is a set of 264 q symbols, where fi 
may be any number; a plain-text letter may be represented by 1, 

2, 3, ... different symbols; conversely, a symbol always repre- 
sents the same plain-text letter, the Bame as is the case in 
method (l). The equivalence between the plain-text and the cipher 
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letters is variable in. encipherment but constant i n -decipher- 
ment. 1 ., 

1 * 

C. In method (3), there is, as In the first method a set 
of 26 symbols; a plain-text letter may be represented by 1, 2, 

3, .... 26 different symbols; conversely, a symbol may- represent 

1, 2, 3, 26.' different plain text letters, depending upon 

the system and the specific key. The equivalence between the 
plain-text and the 'Cipher letters iq variable in both enqipherf 
ment and decipherment. ■ f 

2. Primary classification of polyalphabet ic systems. - a. A' pri- 
mary classification of polyalphabetlc systems into two rather distinct 
types may be made; (l) periodic systems' and (2) aperiodic systems. 

When the enciphering process involves a cryptographic treatment which 
is repetitive in character, and which results in the production of 
cy clic, phenomena in the cryptographic text, the system is termed periodic , 
rffaerr the enciphering process is not of the type described in the fore- 
going general terme, the system is termed aperiodic . The substitution 

in both cases involves the use of two or more cipher alphabets. 

■ i 

£* The cyclic phenomena inherent in a periodic system may be 
exhibited externally, in which case they are said to be patent , or they 
may net be exhibited externally, and must be uncovered by a preliminary 
step in the analysis, in which case they are said to be latent . The 

^ There is a monoalphabet ic method in which the inverse result 
obtains, the correspondence being constant in encipherment but yariable 
in decipherment; this is a method not found in the usual books on cryp- 
tography but in an essay on that subject by Edgar Allan Poe, entitled, 
in some editions of his works, "A few words on secret writing" and, 
in other editions, "Cryptography". The method is to draw up an encipher- 
ing alphabet such as the following (using Poe's example); 

Plain -ABCBEFGHIJKLilNOpQRSTUVWXYZ 
Cipher -SUAVIT3RINH0D0F0RTIT3RIHRE 

In such an alphabet, because of repetitions in the cipher component, 
the plain-text equivalents are subject to a considerable degree of 
variability, as will be seen in the deciphering alphabet; 

Cipher - ABC DEFGHIJKL1SN 0P0RSTUVWXY2 
.Plain - C ^ G 0 E K J L HAF3D 

U I X N Q R 

Z S PVT 

W Y 

This type of variability gives rise to ambiguities in decipherment. A 
cipher group such as TIj3 c would yield such plain-text sequences as REG, 
FIG, TEU, RSU, etc., which could be read only by context . No system of 
such a character would be practical for Berious usage. 
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periodicity may be quite definite in nature, and therefore deter- 
minable ^ith mathematical exactitude allowing for no variability, 
in which case the periodicity ia said to be fixed . In other in- 
stances the periodicity is more or less flexible in character and 
even though it may be determinable mathematically, allowance must 
be made for a degree of variability subject to limits controlled 
by- the specific system under investigation. The periodicity is in 
this case said to be flexible , or Variable within limits . 

3. Primary 'classification of periodic systems. - a. Periodic 
polyalpha betic substitution systems may primarily be classified into 
two kinds. 



(l) Those in which only a few of a whole set of cipher 
1 -'alphabets are used in enciphering individual messages, these 
alphabets being employed repeatedly in a fixed sequence through- 
out each message. Because it is uBual to employ a'eecret word, 
phrase, or number as a 'key to determine the number, identity, 
and sequence with which the cipher alphabets are employed, and 
this key is used over and over again in encipherment, this 
method is often called the rsosating-alnhabet system . It is 
also sometimes referred to as the multiale-ainhabet system 
because if the keying of the entire message be considered as 
a whole it is composed of multiples of a short key used repe- 
titively. In this text the designation "repeating-key system" 
will be used. 

" (2) Those in which all the cipher alphabets comprising 

the complete set for the system are employed one after the other 
progressively in the encipherment of a message, and when the 
last alphabet of the series has been used, the encipherer be- 
gins over again with the' first alphabet. This 1 b commonly re- 
ferred to as a progressive-alphabet system because the cipher 
alphabets are used ih progression. 

i 

4. Sequence of Btudy of polyalphabetic systems. - a. In the 
studies to be followed in connection with polyalpiiabetic systems, 
the order 'in which the vork '/ill proceed conforms very closely to 
the classifications made in paragraphs 2 and 3. Periodic polyalpha- 
betic substitution -ciphers will come first, because they are, as a 
rule, the simpler and because a thorough understanding of the prin- 
ciples of their analysis is prerequisite to a comprehension of how 
aperiodic systems are solved. But in the final analysis the solution 
of examples of both types rests upon the conversion or reduction of 
polyalphabetic ity into monoalphabeticity. If this ia possible, solu- 
tion can alwaye be achieved, granted there are sufficient data in 



French terminology calls this the "double-key method", but there 
is ho logic in such nomenclature. 
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the final monoalphabet ic distributions to permit of solution by re- 
course to the ordinary orinciples of frequency. 

■ i 

b. First ip the ord,er of study of periodic , systems will come 
the analysis of repeating-key systems S.o^e of the- more simple 
varieties r/ill be discussed in detail, with examples. Subsequently, 
ciphers of the progressive type will be discussed. There will then 
follow a more or less detailed treatment of aperiodic systems ., 
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Cipher disks and c.ipher squares 7 



5. Classification of cipher alphabets upon the basis of their 
derivation. - a. The* substitution processes in polyalphabetic methods 
involve the use of a plurality of cipher alphabets. The latter may 
be derived by various schemes, the exact nature of which determines 
the principal characteristics of the cipher alphabets and plays a 
very important role in the preparation and solution of polyalphabetic 
cryptograms. For these reasons it iB advisable, before proceeding 
to a discussion of the principles and methods of analysis, to point 
out these various types of cipher alphabets, show how they are pro- 
duced, and how the method of their production or derivation may be 
made to yield important clues and short-cuts in analysis* 

. -f x 

b. A primary classification of cipher 'alphabets for polyalpha- 
betic substitution may be made into the two' following types: 



(1) Independent ''or Unrelated cipher alphabets. 

(2) Derived or interrelated cipher alphabets. 



£. * Independent cipher alphabets may be disposed of in a very 
few words. They are merely separate and distinct alphabets showing 
no relationship to one another in any way. They may be compiled by 
the various methods discussed In rare. 44 - 43', inclusive, Section IX 
of Special Text No. 165, Elementary Military Cryptography. The solu- 
tion of cryptograms written by means of such alphabets is rendered 
more difficult by reason of the absence of any relationship between 
the equivalents of one cipher alphabet and thbse of any of the other 
alphabets of the same cryptogram. On the other hand, from the point 



I 
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of view of practicability in their production and their handling 
in cryptographing end decrypto graphing, they present some diffi- 
culties which make them less favored by cryptographers than Cipher 
alphabets of the second type. 

d. Derived or interrelated alphabets, as their name indicates; 
are most 1 co>'jmonly produced by the interaction of two p"i lary com- 
ponents, 1 which when juxtaposed at the various points of coincidence 
can be made to yield secondary alphabets . 

6. Primary components and secondary alphabets. - Two basic, 
slidable sequences or components of n characters each will yield n 
secondary alphabets. The components may be classified according 
to various schemes. For cryptanalytic purposes the following classi- 
fication will be found useful; 

CASJ! A. The primary components are both normal sequences. 

(1) The sequences proceed in the Bam9 direction. (The 

secondary alphabets are direct standard alphabets.) 

(2) The sequences proceed, in opposite directions. (The 

secondary alphabets are reversed standard alphabets 
and are reciprocal.) 

CAbJ 3. The primary components are not both normal sequences. 

(1) The plain component is normal, the cipher component 

is a mixed sequence. (The secondary alphabets 
are mixed alphabets.) 

(2) The plain component is a mixed sequence, the cipher 

component is normal. (The secondary alphabets are 
mixed alphabets.) 

(3) Both components qre mixed sequences. 

(a) Components are identical mixed sequences. 

1. Sequences proceed in the same direqtion. 

(The secondary alphabets are mixed alpha- 
bets.) (rar. 23) 

1 1 See tlar. 37, Special Text No. 165. 



2 



See Hare. 49 and 59, Special Text No. 165. 
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II. Sequences proceed in opposite directions. 
(The secondary alpnabets are reciprocal 
-nixed alphabets.) (rfer. 33) 

(b) Components are different mixed sequences. (The 
/ secondary alphabets are nixed alphabets.; 

(i-ar. 39) 

- 7. Cipher disks and cipher squares. - a. Reference is now 

»ade to tars. 60 - 62, Section XII, Special Text Mo. 165, wherein 
was shown the equivalency that subsists between the results produced 
by sliding primary components and cmher disks and square tables of 
the Vigenere type. In all cases the results produced by the succes- 
sive juxtapositions of two sliding components may be duplicated by 
using a cipher square; the converse relationship is true only when 
the columns or rows of the cipher square show symmetry; that is, 
the sequences in the columns or rows are identical but merely dis- 
placed 1, 2, 3, ... intervals successively. 

b. In cryptanalytic studies it is usually more convenient and 
useful, wherever possible, to consider the problem frou the point 
of view of sliding components rather than cipher squares. 

SECTION III 

THEORY OF SOLUTION OF REPEATING- KEY SYSTEMS 

Paragraph 

The three steps in the analysis of repeating-key systems. . 8 



First step: finding the length of the period 9 

General remarks on factoring 10 

Second step: distributing the cipher text into the 

component monoalphabets . . 11 



Third step: solving the monoalphabet ic distributions. ... 12 

8. The three steps in the analysis of repeating-key systems. - 
a. The method of enciphering according to the principle of the re- 
peatmg-key, or repeating alphabets is adequately .explained in Pars. 
57 and 58 of Special Text No. 165, Elementary Military Cryptography, 
and no further reference need be made at this time. The analysis of 
a cryptogram of thi9 type, regardless of the kind of cipher alphabets 
employed, or their method of production, resolves itsolf into three 
distinct and successive steps. 

(l) Determination of tho length of tho repeating key, 
which is tho samo as the determination of the oxact number of 
alphabets involved in the cryptogram; 
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(2) Allocation or distribution of the letters of the 
cipher text into the respective cipher alphabets to which 
they belongs which reduces the polyalphabetic text to mono- 
alphabetic terms; 

(3) Analysis of the individual monoalphabetic distribu- 
tions to determine plain-text values of the cipher letters 

in each distribution or alphabet* 

b. The foregoing steps will be treated in the order in which 
mentioned. The first step may be described briefly as that of 
determining th? period . The second step may be described briefly 
as that of re duction to monoalphabetic terns . The third step my 
be designated as i dentification of cipher-tex t values . 

9. First step* finding the length of the period. - a. The 
determination of the period) that is, the length of the key or the 
number of cipher alphabets involved in a cryptogram enciphered by 
the repeating-key method is, as a rule, a relatively simple matter. 
The cryptogram itself usually manifests externally certain phenomena 
which are the direct result 'of the use of a repeating key. The . 
principles involved are, however, so fundamental in cryptanalysis 
that their elucidation warrants a somewhat detailed treatment. 

This will be done in connection with a short example of encipherment, 
shown below in Fig. 1. 



J). Regardless of what system is used,. identical plain-text let- 
ters enciphered by the same cipher alphabet" 1 must yield identical 
cipher letters. Referring to Fig. 1, such a condition is brought 
about every time that identical plain-text letters happen to be en- 
ciphered with the same key-letter, or every time identical plain-text 
letters fall into the same column in the encipherment .2 Her* since 
the number of columns or positions with respect to the key is very 
limited (except in the case of very long key words) , and since the 
repetition of letters is an inevitable condition in plain text, it 
follows that there will be in a message of fair length many cases 
where identical plain-text letters must fall into the same column. 
They will thus be enciphered by the same aipher alphabet, resulting, 
therefore, in the production of many identical letters in the cipher 
text. When identical plain-text polygraphs fall into identical 



1 It is to be understood, of course, that cipher alphabets with 
single equivalents are meant in this case. 



The frequency with which this condition may be expected to occur 
can be definitely calculated. A discussion of this point falls beyond 
the scope of the present text. 
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